<!DOCTYPE html>
<html lang="zh-CN">





<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/apple-touch-icon.png">
  <link rel="icon" type="image/png" href="/img/favicon.png">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="description" content="安全行业从业者，主要方向PC逆向附带安卓和Linux逆向，时不时喜欢写点BUG代码">
  <meta name="author" content="Cray">
  <meta name="keywords" content="">
  <title>简单PE加载器 ~ 逆向安全博客</title>

  <link rel="stylesheet" href="https://cdn.staticfile.org/font-awesome/5.12.1/css/all.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/mdbootstrap/4.13.0/css/mdb.min.css"  >
<link rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/3.0.1/github-markdown.min.css"  >

<link rel="stylesheet" href="//at.alicdn.com/t/font_1067060_qzomjdt8bmp.css">



  <link rel="stylesheet" href="/lib/prettify/tomorrow.min.css"  >

<link rel="stylesheet" href="/css/main.css"  >


  <link rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css"  >


<meta name="generator" content="Hexo 5.2.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">


    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/">首页</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/archives/">归档</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/tags/">标签</a>
          </li>
        
          
          
          
          
          <li class="nav-item">
            <a class="nav-link" href="/links/">友链</a>
          </li>
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="view intro-2" id="background" false
      style="background: url('https://cdn.jsdelivr.net/gh/L0yy/tuchuang/lmg/20191216121346.png') no-repeat center center;
      background-size: cover;">
    
        <div class="full-bg-img">
        <div class="mask rgba-black-light flex-center">
          <div class="container text-center white-text fadeInUp">
            <span class="h2" id="subtitle">
              
                简单PE加载器
              
            </span>

            
              <br>
              

              <p>
                
                  
                  &nbsp;<i class="far fa-chart-bar"></i>
                  <span class="post-count">
                    1.4k 字
                  </span>&nbsp;
                

                
                  
                  &nbsp;<i class="far fa-clock"></i>
                  <span class="post-count">
                      6 分钟
                  </span>&nbsp;
                

                
                  <!-- 不蒜子统计文章PV -->
                  
                  &nbsp;<i class="far fa-eye" aria-hidden="true"></i>&nbsp;
                  <span id="busuanzi_container_page_pv">
                    <span id="busuanzi_value_page_pv"></span> 次
                  </span>&nbsp;
                
              </p>
            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="py-5 z-depth-3" id="board">
        <div class="post-content mx-auto" id="post">
          <div class="markdown-body">
            <p>思路来源写<code>Sality</code>感染型病毒专杀时指令被严重混淆，通过加载PE 修改内存 跑一下解密算法效率是最高的。</p>
<p>很多病毒在运行的时候都会加载另一个主映像文件去执行，而不是创建进程，就很有意思</p>
<p>下面就是如何加载一个PE，再展开，最后修复执行的过程 </p>
<p>该函数主要是为了将文件映射到内存中，保证源程序安全</p>
<p>返回值是未展开文件在内存中的位置</p>
<pre><code class="C">LPBYTE LoadFileToMem(LPCSTR lpFilePath)
&#123;
    //////////////////////////////////////////////////////////////////////////
    ////将源文件读到内存中                                                  ///
    //////////////////////////////////////////////////////////////////////////
    DWORD FileSize = 0;
    LPBYTE Buff = NULL;

    HANDLE hFile = CreateFileA(lpFilePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    &#123;
        printf(&quot;打开文件句柄错误！[%x]&quot;, GetLastError());
        return -1;
    &#125;

    FileSize = GetFileSize(hFile, NULL);

    Buff = (LPBYTE)malloc(FileSize);
    if (Buff == NULL)
    &#123;
        printf(&quot;空间申请失败![%x]&quot;, GetLastError());
        return -1;
    &#125;

    if (!ReadFile(hFile, Buff, FileSize, &amp;FileSize, NULL))
    &#123;
        printf(&quot;ReadFile![%x]&quot;, GetLastError());
        return -1;
    &#125;
    return Buff;
&#125;</code></pre>
<p>接下来按照各个节的对齐粒度展开<br>返回值是展开后什么都没修复的buff指针</p>
<pre><code class="C">LPBYTE Extension(LPBYTE lpFileBuffer)
&#123;
    //////////////////////////////////////////////////////////////////////////
    ////将文件在内存中展开                                                  ///
    //////////////////////////////////////////////////////////////////////////
    int i = 0; 
    PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)lpFileBuffer;
    PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(lpFileBuffer + pDos-&gt;e_lfanew);
    PIMAGE_SECTION_HEADER pSec = (PIMAGE_SECTION_HEADER)((LPBYTE)pNt + sizeof(IMAGE_NT_HEADERS));

    DWORD ImageSize = pNt-&gt;OptionalHeader.SizeOfImage;

    //LPBYTE lpMemBuffer = (LPBYTE)malloc(ImageSize);
    LPVOID lpMemBuffer = VirtualAlloc(NULL, ImageSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    VirtualProtect(lpMemBuffer, ImageSize, PAGE_EXECUTE_READWRITE, NULL);//这一句可以不要，上面申请的就是可读可写可执行的空间。

    ZeroMemory(lpMemBuffer, ImageSize);

    //文件头的大小
    DWORD dwSizeOfHeader = pNt-&gt;OptionalHeader.SizeOfHeaders;

    //将头部拷贝过去
    CopyMemory(lpMemBuffer, lpFileBuffer, dwSizeOfHeader);


    for (;i &lt; pNt-&gt;FileHeader.NumberOfSections;i++)
    &#123;
        if (pSec-&gt;VirtualAddress == 0 || pSec-&gt;PointerToRawData == 0)
        &#123;
            pSec++;
            continue;
        &#125;
        CopyMemory((LPBYTE)lpMemBuffer + pSec-&gt;VirtualAddress, lpFileBuffer + pSec-&gt;PointerToRawData, pSec-&gt;SizeOfRawData);
        pSec++;
    &#125;

    //已经完全映射，可以把之前的内存释放掉了
    free(lpFileBuffer);
    return lpMemBuffer;
&#125;</code></pre>
<p>修复重定位信息</p>
<p>这一步容易出错，核心原理是重定位表中存的是这个程序需要修复的数据，每个数据都是<code>DWORD</code>类型的<br>可以参考如下地址，主要要注意 <code>pReloca-&gt;VirtualAddress</code>存的是页基质 , <code>pReloca-&gt;SizeOfBlock</code> 包含了<code>IMAGE_BASE_RELOCATION</code> 结构的大小<br><a target="_blank" rel="noopener" href="https://blog.csdn.net/Apollon_krj/article/details/77370452">https://blog.csdn.net/Apollon_krj/article/details/77370452</a></p>
<pre><code class="C">BOOL ReRloc(LPBYTE lpMemBuffer)
&#123;
    //////////////////////////////////////////////////////////////////////////
    ////修复重定位表                                                       ///
    ////原理：遍历重定位表，计算需要重定位数据的地址：重定位后的地址 = 需要重定位的地址 - 默认加载基址 + 当前加载基址
    //////////////////////////////////////////////////////////////////////////
    PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)lpMemBuffer;
    PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(lpMemBuffer + pDos-&gt;e_lfanew);
    //获得重定位表
    PIMAGE_BASE_RELOCATION pReloca = (PIMAGE_BASE_RELOCATION)(lpMemBuffer + pNt-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);

    //如果重定位表为空，上述表达式为pDos+0
    if ((LPBYTE)pReloca == lpMemBuffer)
    &#123;
        printf(&quot;没有重定位表！\n&quot;);
        return TRUE;
    &#125;

    while (pReloca-&gt;VirtualAddress !=0 &amp;&amp; pReloca-&gt;SizeOfBlock !=0 )
    &#123;
        LPWORD pRelData =  (LPBYTE)pReloca + sizeof(IMAGE_BASE_RELOCATION);
        int nNumRel = (pReloca-&gt;SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
        for (int i = 0; i &lt; nNumRel; i++)
        &#123;
            // 每个WORD由两部分组成。高4位指出了重定位的类型，WINNT.H中的一系列IMAGE_REL_BASED_xxx定义了重定位类型的取值。
            // 低12位是相对于VirtualAddress域的偏移，指出了必须进行重定位的位置。

            if ((WORD)(pRelData[i] &amp; 0xF000) == 0x3000) //这是一个需要修正的地址
            &#123;
                //pReloca-&gt;VirtualAddress存的是页基质，(一个页4K，所以是0xFFF，刚好12位)
                LPDWORD pAddress = (LPDWORD)(lpMemBuffer + pReloca-&gt;VirtualAddress + (pRelData[i] &amp; 0x0FFF));


                *pAddress = *pAddress - pNt-&gt;OptionalHeader.ImageBase + (DWORD)pDos;

                printf(&quot;Check!&quot;);
                //DWORD dwDelta = (DWORD)pDos - pNt-&gt;OptionalHeader.ImageBase;
                //*pAddress += dwDelta;
            &#125;
        &#125;
        pReloca = (LPBYTE)pReloca + pReloca-&gt;SizeOfBlock;
    &#125;
    printf(&quot;重定位表修复完成！\n&quot;);
    return TRUE;
&#125;
</code></pre>
<p>修复IAT 这一步也是必须的，在很多壳中是对IAT表进行了Hook，了解一下结构</p>
<p><code>WinNt.h</code>中定义的<code>IMAGE_IMPORT_DESCRIPTOR</code>结构</p>
<pre><code class="C">typedef struct _IMAGE_IMPORT_DESCRIPTOR &#123;
    union &#123;                                 //注意这是union
        DWORD   Characteristics;            // 0 for terminating null import descriptor
        DWORD   OriginalFirstThunk;         // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
    &#125; DUMMYUNIONNAME;
    DWORD   TimeDateStamp;                  // 0 if not bound,
                                            // -1 if bound, and real date\time stamp
                                            //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
                                            // O.W. date/time stamp of DLL bound to (Old BIND)

    DWORD   ForwarderChain;                 // -1 if no forwarders
    DWORD   Name;
    DWORD   FirstThunk;                     // RVA to IAT (if bound this IAT has actual addresses)
&#125; IMAGE_IMPORT_DESCRIPTOR;
typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;</code></pre>
<p><code>OriginalFirstThunk</code> 和 <code>FirstThunk</code> 都指向一个 <code>IMAGE_THUNK_DATA32</code> 结构，该结构是以<code>0</code> 结尾</p>
<p><code>OriginalFirstThunk</code> 是一直不会被修改，程序构建好后就固定 INT<br><code>FirstThunk</code> 在程序加载时动态修改为具体的函数地址，也就是我们常说的IAT</p>
<pre><code class="C">typedef struct _IMAGE_THUNK_DATA32 &#123;
    union &#123;
        DWORD ForwarderString;      // PBYTE 
        DWORD Function;             // PDWORD
        DWORD Ordinal;
        DWORD AddressOfData;        // PIMAGE_IMPORT_BY_NAME
    &#125; u1;
&#125; IMAGE_THUNK_DATA32;
typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;</code></pre>
<p>根据Ordinal的值，判断是按序号导入还是按名称导入，如果是按名称导入则需要去<code>AddressOfData</code>指向的<code>IMAGE_IMPORT_BY_NAME</code>结构中去拿到导入函数名</p>
<pre><code class="C">typedef struct _IMAGE_IMPORT_BY_NAME &#123;
    WORD    Hint;
    CHAR   Name[1];                 //保存具体导入函数的名称
&#125; IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;</code></pre>
<p>如果是序号导入就根据<code>Ordinal</code>的<code>低16</code>位决定</p>
<p><a target="_blank" rel="noopener" href="https://www.cnblogs.com/night-ride-depart/p/5776107.html">https://www.cnblogs.com/night-ride-depart/p/5776107.html</a></p>
<pre><code class="C">BOOL InitIAT(LPBYTE lpMemBuffer)
&#123;
    //////////////////////////////////////////////////////////////////////////
    ////修复IAT                                                            
    //////////////////////////////////////////////////////////////////////////
    PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)lpMemBuffer;
    PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(lpMemBuffer + pDos-&gt;e_lfanew);
    PIMAGE_IMPORT_DESCRIPTOR pImportTalbe = (PIMAGE_IMPORT_DESCRIPTOR)(lpMemBuffer + pNt-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
    LPCSTR szDllname = NULL;
    PIMAGE_THUNK_DATA lpOrgNameArry = NULL;
    PIMAGE_THUNK_DATA lpFirNameArry = NULL;
    PIMAGE_IMPORT_BY_NAME lpImportByNameTable = NULL;
    HMODULE hMou;
    FARPROC Funaddr;
    int i = 0;

    while (pImportTalbe-&gt;OriginalFirstThunk)
    &#123;
        szDllname = lpMemBuffer + pImportTalbe-&gt;Name;
        hMou = GetModuleHandleA(szDllname);
        if (hMou == NULL)
        &#123;
            hMou = LoadLibraryA(szDllname);
            if (hMou == NULL)
            &#123;
                printf(&quot;加载%s失败！[%x]\n &quot;, szDllname, GetLastError());
                return FALSE;
            &#125;
        &#125;

        //dll加载成功，开始导入需要的函数
        lpOrgNameArry = (PIMAGE_THUNK_DATA)(lpMemBuffer + pImportTalbe-&gt;OriginalFirstThunk);

        lpFirNameArry = (PIMAGE_THUNK_DATA)(lpMemBuffer + pImportTalbe-&gt;FirstThunk);

        i = 0;

        while (lpOrgNameArry[i].u1.AddressOfData)
        &#123;
            lpImportByNameTable = (PIMAGE_IMPORT_BY_NAME)(lpMemBuffer + lpOrgNameArry[i].u1.AddressOfData);

            if (lpOrgNameArry[i].u1.Ordinal &amp; 0x80000000 == 1)
            &#123;
                //序号导入
                Funaddr = GetProcAddress(hMou, (LPSTR)(lpOrgNameArry[i].u1.Ordinal &amp; 0xFFFF));
            &#125;
            else
            &#123;
                //名称导入
                Funaddr = GetProcAddress(hMou, lpImportByNameTable-&gt;Name);
            &#125;

            lpFirNameArry[i].u1.Function = Funaddr;
            i++;
        &#125;
        pImportTalbe++;
    &#125;
    return TRUE;
&#125;</code></pre>
<p>最后就是修复<code>ImageBase</code></p>
<pre><code class="C">FARPROC InitEnv(LPBYTE lpMemBuffer)
&#123;
    //////////////////////////////////////////////////////////////////////////
    ////修改ImageBase，返回入口点                                           ///
    //////////////////////////////////////////////////////////////////////////
    PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)lpMemBuffer;
    PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(lpMemBuffer + pDos-&gt;e_lfanew);
    pNt-&gt;OptionalHeader.ImageBase = lpMemBuffer;

    return lpMemBuffer + pNt-&gt;OptionalHeader.AddressOfEntryPoint;
&#125;</code></pre>
<p>返回这个被加载程序的入口地址，直接调用就好</p>
<p>吃水不忘挖井人 参考来源<br><a target="_blank" rel="noopener" href="https://bbs.pediy.com/thread-249133.htm">https://bbs.pediy.com/thread-249133.htm</a></p>

            <hr>
          </div>
          <br>
          <div>
            <p>
            
            
              <span>
                <i class="iconfont icon-tag"></i>
                
                  <a class="hover-with-bg" href="/tags/%E9%80%86%E5%90%91/">逆向</a>
                
              </span>
            
            </p>
            
              <p class="note note-warning">本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://zh.wikipedia.org/wiki/Wikipedia:CC_BY-SA_3.0%E5%8D%8F%E8%AE%AE%E6%96%87%E6%9C%AC" rel="nofollow noopener noopener">CC BY-SA 3.0协议</a> 。转载请注明出处！</p>
            
          </div>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container">
        <div id="toc">
  <p class="h5"><i class="far fa-list-alt"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>
      </div>
    
  </div>
</div>

<!-- custom -->


<!-- Comments -->
<div class="col-lg-7 mx-auto nopadding-md">
  <div class="container comments mx-auto" id="comments">
    
      <br><br>
      
      
  <div class="disqus" style="width:100%">
    <div id="disqus_thread"></div>
    <script>
      var disqus_config = function () {
        this.page.url = 'http://cve.gitee.io/cve/2019/12/07/简单PE加载器/';
        this.page.identifier = '/2019/12/07/简单PE加载器/';
      };
      var oldLoad = window.onload;
      window.onload = function () {
        var d = document, s = d.createElement('script');
        s.type = 'text/javascript';
        s.src = '//' + 'crayon-1' + '.disqus.com/embed.js';
        s.setAttribute('data-timestamp', +new Date());
        (d.head || d.body).appendChild(s);
      };
    </script>
    <noscript>Please enable JavaScript to view the <a target="_blank" href="https://disqus.com/?ref_noscript" rel="nofollow noopener noopener">comments
        powered by Disqus.</a></noscript>
  </div>


    
  </div>
</div>

    
  </main>

  
    <a class="z-depth-1" id="scroll-top-button" href="#" role="button">
      <i class="fa fa-chevron-up scroll-top-arrow" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  <footer class="mt-5">
  <div class="text-center py-3">
    <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><b>Hexo</b></a>
    <i class="iconfont icon-love"></i>
    <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"> <b>Fluid</b></a>
    <br>

    
  
    <!-- 不蒜子统计PV -->
    
    &nbsp;<span id="busuanzi_container_site_pv"></span>总访问量 
          <span id="busuanzi_value_site_pv"></span> 次&nbsp;
  
  
    <!-- 不蒜子统计UV -->
    
    &nbsp;<span id="busuanzi_container_site_uv"></span>总访客数 
            <span id="busuanzi_value_site_uv"></span> 人&nbsp;
  
  <br>



    


    <!-- cnzz Analytics icon -->
    

  </div>
</footer>

<!-- SCRIPTS -->
<script src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script src="https://cdn.staticfile.org/popper.js/1.16.1/umd/popper.min.js" ></script>
<script src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script src="https://cdn.staticfile.org/mdbootstrap/4.13.0/js/mdb.min.js" ></script>
<script src="/js/main.js" ></script>


  <script src="/js/lazyload.js" ></script>



  
  <script src="https://cdn.staticfile.org/tocbot/4.10.0/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var navHeight = $('#navbar').height();
      var toc = $('#toc');
      var main = $('main');
      var tocT = navHeight + (toc.offset().top - main.offset().top);
      var tocLimMin = main.offset().top - navHeight;
      var tocLimMax = $('#comments').offset().top - navHeight;
      $(window).scroll(function () {
        var scroH = document.body.scrollTop + document.documentElement.scrollTop;
        if (tocLimMin <= scroH && scroH <= tocLimMax) {
          toc.css({
            'display': 'block',
            'position': 'fixed',
            'top': tocT,
          });
        } else if (scroH <= tocLimMin) {
          toc.css({
            'position': '',
            'top': '',
          });
        } else if (scroH > tocLimMax) {
          toc.css('display', 'none');
        }
      });
      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '.post-content',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        scrollSmooth: true,
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc > p').css('visibility', 'visible');
      }
    });
  </script>







  <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>


<!-- Plugins -->



  <script src="https://cdn.staticfile.org/prettify/188.0.0/prettify.min.js" ></script>
  <script>
    $(document).ready(function () {
      $('pre').addClass('prettyprint  linenums');
      prettyPrint();
    })
  </script>





  <script src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      getSearchFile(path);
      this.onclick = null
    }
  </script>



  <script src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <script>
    $("#post img:not(.no-zoom img, img[no-zoom])").each(
      function () {
        var element = document.createElement("a");
        $(element).attr("data-fancybox", "images");
        $(element).attr("href", $(this).attr("src"));
        $(this).wrap(element);
      }
    );
  </script>












</body>
</html>
